Sophos Limited

Vanja Svajcer

Fraser Howard

Paul Oliver Baccas

William James McCourt

Benjamin John Godwood

In embodiments of the present invention improved capabilities are described for detecting restricted content associated with retrieved content. The method and system may include receiving a client request for content, saving contextual information from the client request, presenting retrieved content in response to the client request, and presenting the contextual information from the client request, and retrieved content, to a scanning facility. The scanning facility may utilize the contextual information from the client request to aid in the detection of restricted content associated with retrieved content.

Method and system for detecting restricted content associated with retrieved content

Techniques are described for detecting restricted content associated with retrieved content. A method and system includes receiving a client request for content, where the request includes an outbound network request from the client with a Uniform Resource Identifier (URI) containing a domain name, saving contextual information from the request, examining the request for compliance with a management policy, retrieving a content item responsive to the request, and analyzing the contextual information from the request and the content item to detect whether the content item includes restricted content from a list of restrictions in the management policy. A scanning facility may thus utilize the contextual information from the client request to aid in the detection of restricted content associated with retrieved content.

Aspects of this invention may relate to a malicious application remedial action request application where a network site interaction may be requested from a client computing facility; the network site interaction from the client computing facility may be determined to be unacceptable based on an acceptance policy at a gateway facility; access to the network site from the client computing facility may be denied; information relating to the attempted interaction with the network site may be sent from the gateway facility to the client computing facility, wherein the information may indicate that the attempted interaction occurred; and the client computing facility may interpret the information relating to the attempted interaction, determine whether the attempted interaction was the result of an automatically generated request, and take remedial action in the event that the attempted interaction was the result of the automatically generated request.

Growing community of inventors

Oxford, United Kingdom

Vanja Svajcer